Hi,
I'm using eventgen to create sample data.
Whenever someone runs a command, the Linux audits will record the event over multiple lines.
For example, if someone uses sudo to run 'cat /etc/shadow'. The audit log will record the user's attempt to access sudo, then another line that will show the authentication status (success or failure), then the actual command, '/etc/shadow', etc...
Is there a way to set the token replacement to change the username, hostname, time, command for that event and do it, say 30 times. Each event which has multiple lines with have the same username, hostname, time and command. Then the next event will have a different username, hostname, time and command?
Thanks,
Bruce
